[转]Setting Keystone v3 domains
http://www.florentflament.com/blog/setting-keystone-v3-domains.html
The Openstack Identity v3 API, provided by Keystone, offers features that were lacking in the previous version. Among these features, it introduces the concept of domains, allowing isolation of projects and users. For instance, an administrator allowed to create projects and users in a given domain, may not have any right in another one. While these features look very exciting, some configuration needs to be done to have a working identity v3 service with domains properly set.
Keystone API protection section of the developer's doc provides hints about how to set-up a multi-domain installation. Starting from there, I describe the full steps to have a multi-domain setup running, by using curl
to send http requests and jq
to parse the json answers.
Setting an admin domain and a cloud admin
First, we have to start on a fresh non multi-domain installation with the default policy file.
With the
admin
user we can create theadmin_domain
.ADMIN_TOKEN=$(\
curl http://localhost:5000/v3/auth/tokens \
-s \
-i \
-H "Content-Type: application/json" \
-d '
{
"auth": {
"identity": {
"methods": [
"password"
],
"password": {
"user": {
"domain": {
"name": "Default"
},
"name": "admin",
"password": "password"
}
}
},
"scope": {
"project": {
"domain": {
"name": "Default"
},
"name": "admin"
}
}
}
}' | grep ^X-Subject-Token: | awk '{print $2}' ) ID_ADMIN_DOMAIN=$(\
curl http://localhost:5000/v3/domains \
-s \
-H "X-Auth-Token: $ADMIN_TOKEN" \
-H "Content-Type: application/json" \
-d '
{
"domain": {
"enabled": true,
"name": "admin_domain"
}
}' | jq .domain.id | tr -d '"' ) echo "ID of domain cloud: $ID_ADMIN_DOMAIN"Then we can create our
cloud_admin
user, within theadmin_domain
domain.ID_CLOUD_ADMIN=$(\
curl http://localhost:5000/v3/users \
-s \
-H "X-Auth-Token: $ADMIN_TOKEN" \
-H "Content-Type: application/json" \
-d "
{
\"user\": {
\"description\": \"Cloud administrator\",
\"domain_id\": \"$ID_ADMIN_DOMAIN\",
\"enabled\": true,
\"name\": \"cloud_admin\",
\"password\": \"password\"
}
}" | jq .user.id | tr -d '"' ) echo "ID of user cloud_admin: $ID_CLOUD_ADMIN"And we grant to our user
cloud_admin
theadmin
role on domainadmin_domain
.ADMIN_ROLE_ID=$(\
curl http://localhost:5000/v3/roles?name=admin \
-s \
-H "X-Auth-Token: $ADMIN_TOKEN" \
| jq .roles[0].id | tr -d '"' ) curl -X PUT http://localhost:5000/v3/domains/${ID_ADMIN_DOMAIN}/users/${ID_CLOUD_ADMIN}/roles/${ADMIN_ROLE_ID} \
-s \
-i \
-H "X-Auth-Token: $ADMIN_TOKEN" \
-H "Content-Type: application/json" curl http://localhost:5000/v3/domains/${ID_ADMIN_DOMAIN}/users/${ID_CLOUD_ADMIN}/roles\
-s \
-H "X-Auth-Token: $ADMIN_TOKEN" | jq .rolesOnce the
admin_domain
has been created with itscloud_admin
user, we can enforce a domain based policy. In order to do that, we have to copy the policy.v3cloudsample.json file over our former/etc/keystone/policy.json
, while replacing the stringadmin_domain_id
by the ID of theadmin_domain
we just created. Locate thepolicy.v3cloudsample.json
file into theetc
directory of Keystone's source.sed s/admin_domain_id/${ID_ADMIN_DOMAIN}/ \
< policy.v3cloudsample.json \
> /etc/keystone/policy.json
Warning, current version (commit 19620076f587f925c5d2fa59780c1a80dde15db2) of policy.v3cloudsample.json doesn't allow cloud_admin
to manage users in other domains than its own (see bug 1267187). Until the patch is merged, I suggest using this policy.c3cloudsample.json under review.
Creating domains and admins
From now on, the admin
user can only manage projects and users in the Default
domain. To create other domains we will have to authenticate with the cloud_admin
user created above.
Getting a token scoped on the
admin_domain
, for usercloud_admin
.CLOUD_ADMIN_TOKEN=$(\
curl http://localhost:5000/v3/auth/tokens \
-s \
-i \
-H "Content-Type: application/json" \
-d '
{
"auth": {
"identity": {
"methods": [
"password"
],
"password": {
"user": {
"domain": {
"name": "admin_domain"
},
"name": "cloud_admin",
"password": "password"
}
}
},
"scope": {
"domain": {
"name": "admin_domain"
}
}
}
}' | grep ^X-Subject-Token: | awk '{print $2}' )Creating domains
dom1
anddom2
.ID_DOM1=$(\
curl http://localhost:5000/v3/domains \
-s \
-H "X-Auth-Token: $CLOUD_ADMIN_TOKEN" \
-H "Content-Type: application/json" \
-d '
{
"domain": {
"enabled": true,
"name": "dom1"
}
}' | jq .domain.id | tr -d '"') echo "ID of dom1: $ID_DOM1" ID_DOM2=$(\
curl http://localhost:5000/v3/domains \
-s \
-H "X-Auth-Token: $CLOUD_ADMIN_TOKEN" \
-H "Content-Type: application/json" \
-d '
{
"domain": {
"enabled": true,
"name": "dom2"
}
}' | jq .domain.id | tr -d '"') echo "ID of dom2: $ID_DOM2"Now we will create a user
adm1
in domaindom1
.ID_ADM1=$(\
curl http://localhost:5000/v3/users \
-s \
-H "X-Auth-Token: $CLOUD_ADMIN_TOKEN" \
-H "Content-Type: application/json" \
-d "
{
\"user\": {
\"description\": \"Administrator of domain dom1\",
\"domain_id\": \"$ID_DOM1\",
\"enabled\": true,
\"name\": \"adm1\",
\"password\": \"password\"
}
}" | jq .user.id | tr -d '"') echo "ID of user adm1: $ID_ADM1"We will also grant the
admin
role on domaindom1
to thisadm1
user.curl -X PUT http://localhost:5000/v3/domains/${ID_DOM1}/users/${ID_ADM1}/roles/${ADMIN_ROLE_ID} \
-s \
-i \
-H "X-Auth-Token: $CLOUD_ADMIN_TOKEN" \
-H "Content-Type: application/json" curl http://localhost:5000/v3/domains/${ID_DOM1}/users/${ID_ADM1}/roles \
-s \
-H "X-Auth-Token: $CLOUD_ADMIN_TOKEN" | jq .roles
Creating projects and users
The adm1
user can now fully manage domain dom1
. He is allowed to manage as many projects and users as he wishes within dom1
, while not being able to access resources of domain dom2
.
Now we authenticate as user
adm1
with a scope ondom1
.ADM1_TOKEN=$(\
curl http://localhost:5000/v3/auth/tokens \
-s \
-i \
-H "Content-Type: application/json" \
-d '
{
"auth": {
"identity": {
"methods": [
"password"
],
"password": {
"user": {
"domain": {
"name": "dom1"
},
"name": "adm1",
"password": "password"
}
}
},
"scope": {
"domain": {
"name": "dom1"
}
}
}
}' | grep ^X-Subject-Token: | awk '{print $2}' )We create a project
prj1
in domaindom1
.ID_PRJ1=$(\
curl http://localhost:5000/v3/projects \
-s \
-H "X-Auth-Token: $ADM1_TOKEN" \
-H "Content-Type: application/json" \
-d "
{
\"project\": {
\"enabled\": true,
\"domain_id\": \"$ID_DOM1\",
\"name\": \"prj1\"
}\
}" | jq .project.id | tr -d '"' ) echo "ID of prj1: $ID_PRJ1"When trying and creating a project in domain
dom2
, it fails.curl http://localhost:5000/v3/projects \
-s \
-H "X-Auth-Token: $ADM1_TOKEN" \
-H "Content-Type: application/json" \
-d "
{
\"project\": {
\"enabled\": true,
\"domain_id\": \"$ID_DOM2\",
\"name\": \"prj2\"
}\
}" | jq .Creating a standard user
usr1
in domaindom1
, with default projectprj1
.ID_USR1=$(\
curl http://localhost:5000/v3/users \
-s \
-H "X-Auth-Token: $ADM1_TOKEN" \
-H "Content-Type: application/json" \
-d "
{
\"user\": {
\"default_project_id\": \"$ID_PRJ1\",
\"description\": \"Just a user of dom1\",
\"domain_id\": \"$ID_DOM1\",
\"enabled\": true,
\"name\": \"usr1\",
\"password\": \"password\"
}
}" | jq .user.id | tr -d '"' ) echo "ID of user usr1: $ID_USR1"Granting
Member
role to userusr1
on projectprj1
.MEMBER_ROLE_ID=$(\
curl http://localhost:5000/v3/roles?name=Member \
-s \
-H "X-Auth-Token: $ADM1_TOKEN" \
| jq .roles[0].id | tr -d '"' ) curl -X PUT http://localhost:5000/v3/projects/${ID_PRJ1}/users/${ID_USR1}/roles/${MEMBER_ROLE_ID} \
-s \
-i \
-H "X-Auth-Token: $ADM1_TOKEN" \
-H "Content-Type: application/json" curl http://localhost:5000/v3/projects/${ID_PRJ1}/users/${ID_USR1}/roles \
-s \
-H "X-Auth-Token: $ADM1_TOKEN" | jq .roles
The domain administrator adm1
ended up creating a project prj1
and a user usr1
member of the project. usr1
can now get a token scoped onprj1
and manage resources into this project.
[转]Setting Keystone v3 domains的更多相关文章
- 在Keystone V3基础上改进的分布式认证体系
目标 使用java实现keystone v3相关功能与概念: api client authentication service discovery distributed multi-tenant ...
- OpenStack IdentityService Keystone V3 API Curl实战
v3 API Examples Using Curl <Tokens> 1,Default scope 获取token Get an token with default scope (m ...
- 使用openstackclient调用Keystone v3 API
本文内容属于个人原创,转载务必注明出处: http://www.cnblogs.com/Security-Darren/p/4138945.html 考虑到Keystone社区逐渐弃用第二版身份AP ...
- [转]OpenStack Keystone V3
Keystone V3 Keystone 中主要涉及到如下几个概念:User.Tenant.Role.Token.下面对这几个概念进行简要说明. User:顾名思义就是使用服务的用户,可以是人.服务或 ...
- OpenStack Keystone V3 简介
Keystone V3 简介 Keystone 中主要涉及到如下几个概念:User.Tenant.Role.Token.下面对这几个概念进行简要说明. User:顾名思义就是使用服务的用户,可以是人. ...
- Keystone V3 API Examples
There are few things more useful than a set of examples when starting to work with a new API. Here a ...
- 【openStack】Libcloud 如何支持 keystone V3?
Examples This section includes some examples which show how to use the newly available functionality ...
- OpenStack Keystone v3 API新特性
原连接 http://blog.chinaunix.net/uid-21335514-id-3497996.html keystone的v3 API与v2.0相比有很大的不同,从API的请求格式到re ...
- Openstack Keystone V3 利用 curl 命令获取 token
curl -i \ -H "Content-Type: application/json" \ -d ' { "auth": { "identity& ...
随机推荐
- Springboot 打jar包分离lib,配置文件正确方式
文章来源:https://my.oschina.net/xiaozhutefannao/blog/1932764 POM.xml <?xml version="1.0" en ...
- Zabbix (五)
介绍添加主机时,各个参数的含义 https://blog.51cto.com/5001660/2154692 Zabbix配置介绍: https://blog.51cto.com/5001660/21 ...
- ansible小技巧
出现带'u'的 unicode编码, 在python里 .encode()回去,尤其是经过shell处理的,最好在shell中使用jinja2来处理一下 最好这种情况在shell模块使用jinja2的 ...
- Loda Button
当从服务器获取数据时,这个简单的jQuery插件会动画按钮的图标.(单击上面的按钮进行演示 - 超时2秒模仿服务器负载). 按钮的标记很简单: HTML <a href="#" ...
- 【Linux】Ubuntu安装Mysql 8.0
1.下载Mysql的安装配置,http://dev.mysql.com/downloads/repo/apt/ 2.执行配置配置文件 sudo dpkg -i mysql-apt-config_0.* ...
- Jmeter3.2默认自带的HTML报告
jmeter -JthreadNum=50 -JinSec=1 -Jduration=300 -n -t $JMETER_HOME/XNZX/scripts/XNZX_APP.jmx -l $JMET ...
- 蓝桥杯 穿越雷区(bfs)
题目描述 X星的坦克战车很奇怪,它必须交替地穿越正能量辐射区和负能量辐射区才能保持正常运转,否则将报废.某坦克需要从A区到B区去(A,B区本身是安全区,没有正能量或负能量特征),怎样走才能路径最短? ...
- Vue生命周期,面试常见问题
一.对于MVVM的理解? MVVM 是 Model-View-ViewModel 的缩写.Model代表数据模型,也可以在Model中定义数据修改和操作的业务逻辑.View 代表UI 组件,它负责将数 ...
- Centos将yum源设置为阿里云的镜像源
第一步:备份原有镜像源 mv /etc/yum.repo.d/Centos-Base.repo /etc/yum.repo.d/Centos-Base.repo.bak 第二步:下载阿里云的镜像源 w ...
- vue基础5-生命周期
1.vue实例的生命周期 1.1.什么是生命周期? --从Vue实例创建.运行.销毁期间,总是伴随着各式各样的事件,这些事件,统称为生命周期! 1.2.生命周期钩子:就是生命周期事件的别名而已: ...